Make _[body|query|route]_params as (private) request attributes.

Implement the TODO comment that the body/query/route params should be attributes.

The existing setters decode their params to characters, eliminating the internal
'params_are_decoded' flag. If you know you have characters, the request object
hash can still be directly manipulated; such as after deserialization which
resolves #229.

Add test case with route params and body data to check decoding.
Verify all core serializers decode body content to characters.
Cleanup request class - remove stale pod and unused ajax attribute.
Update notes around request params and body deserialization.

Hopefully this makes things clearer for when we all forget why the
internal setter isn't used for storing the deserialized request body.
(i.e. avoids a side effect of calling decode on numerical values).

Thanks @xsaywerx for the prompt to explain it better!
Update changes
Merge branch 'cherry/382'